}
      }
      else -> {
        if (reservedFlag1) throw ProtocolException("Unexpected rsv1 flag")
      }
    }

    val reservedFlag2 = b0 and B0_FLAG_RSV2 != 0
    if (reservedFlag2) throw ProtocolException("Unexpected rsv2 flag")

    val reservedFlag3 = b0 and B0_FLAG_RSV3 != 0
    if (reservedFlag3) throw ProtocolException("Unexpected rsv3 flag")

    val b1 = source.readByte() and 0xff

      when {
        length0 == 0b1000_0000 -> {
          throw ProtocolException("indefinite length not permitted for DER")
        }
        (length0 and 0b1000_0000) == 0b1000_0000 -> {
          // Length specified over multiple bytes.
          val lengthBytes = length0 and 0b0111_1111
          if (lengthBytes > 8) {
            throw ProtocolException("length encoded with more than 8 bytes is not supported")
          }

    val bytes = "170d3139313231362333303231305a".decodeHex()
    assertFailsWith<ProtocolException> {
      Adapters.UTC_TIME.fromDer(bytes)
    }.also { expected ->
      assertThat(expected).hasMessage("Failed to parse UTCTime 191216#30210Z")
    }
  }

  @Test fun `cannot decode generalized time with offset`() {
    assertFailsWith<ProtocolException> {

    assertFailsWith<ProtocolException> {
      clientReader.processNextFrame()
    }.also { expected ->
      assertThat(expected.message)
        .isEqualTo("Control frames must be final.")
    }
  }

  @Test fun reservedFlag1IsUnsupportedWithNoCompression() {
    data.write("ca00".decodeHex()) // Empty pong, flag 1 set.
    assertFailsWith<ProtocolException> {
      clientReader.processNextFrame()

import assertk.assertions.isNotNull
import assertk.assertions.isNull
import java.io.EOFException
import java.io.IOException
import java.io.InterruptedIOException
import java.net.HttpURLConnection
import java.net.ProtocolException
import java.net.SocketTimeoutException
import java.time.Duration
import java.util.Arrays
import java.util.Collections
import java.util.Random
import java.util.concurrent.CountDownLatch

          throw ProtocolException(
            "expected chunk size and optional extensions" +
              " but was \"$bytesRemainingInChunk$extensions\"",
          )
        }
      } catch (e: NumberFormatException) {
        throw ProtocolException(e.message)
      }

      if (bytesRemainingInChunk == 0L) {
        hasMoreChunks = false

 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package okhttp3.tls.internal.der

import java.math.BigInteger
import java.net.ProtocolException
import okio.ByteString

/**
 * ASN.1 adapters adapted from the specifications in [RFC 5280][rfc_5280].
 *
 * [rfc_5280]: https://tools.ietf.org/html/rfc5280
 */

import java.net.HttpURLConnection.HTTP_PROXY_AUTH
import java.net.HttpURLConnection.HTTP_SEE_OTHER
import java.net.HttpURLConnection.HTTP_UNAUTHORIZED
import java.net.HttpURLConnection.HTTP_UNAVAILABLE
import java.net.ProtocolException
import java.net.Proxy
import java.net.SocketTimeoutException
import java.security.cert.CertificateException
import javax.net.ssl.SSLHandshakeException
import javax.net.ssl.SSLPeerUnverifiedException

        val peekedHeader =
          reader.peekHeader()
            ?: throw ProtocolException("expected a value at $reader")

        val choice =
          choices.firstOrNull { it.matches(peekedHeader) }
            ?: throw ProtocolException(
              "expected a matching choice but was $peekedHeader at $reader",
            )

import assertk.assertions.isFalse
import assertk.assertions.isGreaterThan
import assertk.assertions.isLessThan
import assertk.assertions.isTrue
import java.io.EOFException
import java.io.IOException
import java.net.ProtocolException
import java.net.SocketTimeoutException
import java.util.Random
import kotlin.test.assertFailsWith
import okhttp3.FailingCall
import okhttp3.Headers
import okhttp3.Headers.Companion.headersOf